[Timepoint List] Hide visits that are from user unaffiliated projects

modules/candidate_profile/test/TestPlan.md

@@ -50,6 +50,7 @@ that widget (ie. the media module for CandID 587630 (DCC090) or CandID 300001 (M
 4. Ensure that, when the module which added the extra `CandidateInfo` terms
    is disabled, the terms from that module no longer show up in the
    `Candidate Info` card.
+5. Ensure that you cannot access profiles from projects that you are not affiliated with. This behaviour is still expected when you have permission `access_all_profiles`.
 
 All other widgets are part of other modules, and should be tested as
 part of that module's testing.

modules/timepoint_list/test/TestPlan.md

@@ -5,6 +5,7 @@
     - For a candidate of a different site than your user, ensure that either 
         - `access_all_profiles` permission is required 
         - or that the candidate's registration site is the same as the user's site
+    - Ensure that you cannot access profiles from projects that you are not affiliated with. This behaviour is still expected when you have permission `access_all_profiles`.
 2. **Action buttons** 
     - For a candidate of a different site than your user, attempt to access the timepoint list via the url. The page should load with a message of 'Permission Denied'.
     - For a candidate of the same site as your user, there should be up to 3 additional buttons: